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In theory, quantum key distribution (QKD) offers unconditional security based on the 
laws of physics. However, as demonstrated in recent quantum hacking theory and ex- 
perimental papers, detection efficiency loophole can be fatal to the security of practical 
QKD systems. Here, we describe the physical origin of detection efficiency mismatch 
in various domains including spatial, spectral, and time domains and in various exper- 
imental set-ups. More importantly, we prove the unconditional security of QKD even 
with detection efficiency mismatch. We explicitly show how the key generation rate is 
characterized by the maximal detection efficiency ratio between the two detectors. Fur- 
thermore, we prove that by randomly switching the bit assignments of the detectors, the 
effect of detection efficiency mismatch can be completely eliminated. 
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1 Introduction 

Quantum key distribution (QKD) [1-3] provides a way for two legitimate users, Alice and 
Bob, to share a secret key that is secure against an eavesdropper, Eve, who is only restricted 
by quantum mechanics. After the successful sharing of the secret key, Alice and Bob can 
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then use it in cryptographic applications such as secure communications and authentication. 
Many previous unconditional security proofs for QKD [4-15] consider the case with perfect 
devices, such as perfect single-photon sources. However, realistic devices are never perfect. 
For example, weak coherent sources are widely used in practice to simulate single-photon 
emissions. Thus, security proofs have to be extended to cover these practical imperfections 
in order to guarantee the security of a practical system. Recently, the use of weak coherent 
sources and threshold detectors have been considered by various security proofs [16-22]. In 
this paper, we consider another realistic imperfection found in detectors, which is the depen- 
dency of detection efficiency on some auxiliary dimension such as the arrival time of signal; 
furthermore, the efficiencies of the two detectors can be different. We prove the unconditional 
security for this case. In this paper, we consider a QKD scheme where Bob uses two separate 
detectors for detecting bits "0" and "1". 

The general physical problem we are facing in practical QKD system with two detectors 
is the detection efficiency loophole [23,24]. This loophole underlies not only fundamental 
physics like Bell inequalities, but also applied technology like QKD. Also, in practice, it is 
hard to build two detectors that have exactly the same characteristics (e.g. frequency, time 
and spatial responses). Moreover, the problem of detection efficiency mismatch is important 
not only for gated detectors, but also for detectors with dead-times. Indeed, standard InGaAs 
detectors (and even SSPDs) have dead-times. That is to say that after a detection event, a 
detector becomes inactive for some prescribed time duration. If Bob registers a signal during 
a time period when one detector is dead while the other one is still active, Eve will be able 
to infer which detector clicks. Our paper is an illustration of how one can proceed to handle 
this general problem of detection efficiency mismatch in the security of QKD. 

In fact, attacks drawing on detection efficiency mismatch have been proposed before: the 
faked states attack [25,26] and the time-shift attack [27]. The faked-states attack [25,26] is 
an intercept-and-resend attack, which is challenging to implement because of synchronization 
and interferometric stability issues. For this reason, the faked-states attack has never been 
implemented experimentally. In contrast, the time-shift attack [27] does not involve any 
measurement and is, therefore, easier to implement in this regard. Indeed, we have successfully 
demonstrated the time-shift attack experimentally on a commercial QKD system [28] , which 
indicates that detection efficiency mismatch is a serious realistic issue that can have a fatal 
effect on practical securitjj? 

The success of the faked-states attack and the time-shift attack relies on the existence 
of detection efficiency mismatch and the assumption that Alice and Bob distill keys using 
a standard security proof that ignores this efficiency mismatch. As we have noted before 
[28,30], once Alice and Bob are aware of an attack based on some imperfection, it may not 
be too difficult for them to devise counter measures against it. On the other hand, counter- 
measures against eavesdropping can often lead to new loopholes and/or be defeated by new 
eavesdropping attacks. For instance, the four-state setting [31,32] by Bob (intended to counter 

a Note that to implement the time-shift attack successfully, one may need to implement time compression of 
signals. The signals being compressed here are strong classical pulses from Bob to Alice in a plug-and-play 
system. Fortunately, compression of strong classical pulses is a mature standard technique that has been used 
in industries for decades (see, e.g., [29]). For simplicity, the experiment in Ref. [28] did not implement this 
mature standard technique but simulated this compression process by replacing the original laser source with 
one that produces narrower pulses. 
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attacks based on detection efficiency mismatch) can be defeated by a combination of the large- 
pulse attack [33] and the time-shift attack [30,34]. Instead of implementing physical counter- 
measures, another way to guard against attacks based on detection efficiency mismatch is 
for Alice and Bob to take this imperfection into account when distilling keys. Because of 
this imperfection, an extra amount of privacy amplification will be needed. In this paper, we 
provide an unconditional security proof that takes detection efficiency mismatch into account, 
and by using this proof, Alice and Bob will be able to determine the right amount of privacy 
amplification needed to remove Eve's information on the final key even in the presence of 
detection efficiency mismatch. We note that our proof is valid even if Eve performs the most 
general attack that correlates different signal transmissions. 

In this paper, we consider the BB84 protocol [1], but the idea of our security proof can be 
used for other protocols. For simplicity, for much of this paper, we consider that the input 
to Bob are single-photon signals. The case of multi-photon input signals will be discussed 
in Sec. 17.11 For each transmission by Alice, Eve resends two systems to Bob: one system 
carrying the bit information and the other system representing the auxiliary system that the 
efficiencies of the detectors respond to. We assume in this paper that the information-carrying 
system is a qubit. On the other hand, the auxiliary system can have arbitrary dimension and 
is completely controlled by Eve in order to produce different effects on Bob due to imperfect 
detection efficiencies. More specifically, Eve can send Bob an arbitrary state in this auxiliary 
system to induce different probabilities of detection for the two detectors. Overall, Bob's 
system is represented by an enlarged quantum space and the bit information only lives in 
a qubit subspace of it. Thus, our security proof is one that applies to a protocol with an 
enlarged quantum space (which has recently been formalized in Ref. [35]). Also, we note that 
this auxiliary system essentially acts as a shield [36] that protects Alice and Bob's key from 
Eve. Thus, our proof serves as an example of shield analysis. 

Bob's measurement operates on both the qubit system (which carries the information) 
and the auxiliary system (which affects the detection efficiencies) and we need a detector 
model that incorporates both systems. In this paper, we do not attempt to treat the most 
general measurements but to assume a slightly more restrictive detector model that does not 
couple the two systems. In other words, our model applies whenever the information-carrying 
dimension does not couple with the efficiency-affecting dimension in the detection process. 
This detector model by no means covers all possible detection scenario^ 6 but is general enough 
to include many interesting ones (such as those described in Sec. [5]) that arise in practice. It 
is important to note that even though the detector model does not couple the two systems, 
they can be arbitrarily coupled (entangled) in the input state sent by Eve. 

To get a glimpse at our detector model, let's first consider the case where there is no Eve 
and no efficiency mismatch. In this case, the entanglement view of Alice's and Bob's systems 
is simply the perfect EPR pair |00) AS + |H)^ B - Now, supposing that there is efficiency 
mismatch and each detector i has a constant efficiency rji, the state can then be represented 
as ^/t]o\00}ab + VVi\^1)abi which can be regarded as a non-uniform EPR pair. This simple 
case is a special case of what we consider in our security proof. In fact, we consider a detector 
model that goes beyond the scalar efficiency model. Our model can incorporate, for example, 
states of the form |00) AS ® (F \j) T ) + |H)ab ® C^i It)t)' where Fi is the filtering operation 



b For instance, our detector model does not cover the case when Bob's Hilbert space is a qutrit. 
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of detector i acting on system T modeling the detector's efficiency response and I7) is an 
arbitrary state chosen by Eve to induce different effects on the two detectors. The difficulty 
in proving the security is related to the non-uniformity in bits "0" and "1" of the overall state 
and the fact the initial state in system T is arbitrary. Nevertheless, we propose a technique 
that proves the security even though Eve can choose any state in system T. 

Our proof considers that Alice uses a single-photon source. However, our result immedi- 
ately applies to the case when Alice uses a phase-randomized weak coherent source, by using 
the results of Ref. [17,18]. Our proof is founded on Koashi's general security proof based 
on the uncertainty principle [18]. The essential strategy is to estimate how certain Bob can 
predict Alice's measurement outcomes in the basis conjugate to the key-generating basis. To 
do this, we consider a virtual protocol in which Bob performs a virtual measurement on his 
enlarged quantum space where the information-carrying qubit is embedded. His measurement 
result then gives a good prediction of Alice's. 

Intuition tells us that the larger the mismatch between the two detectors is, the lower 
the key generation rate becomes. We confirm this belief in our paper and explicitly quantify 
the exact effect of the mismatch on the key generation rate. We show that the maximum 
efficiency ratio between the two detectors is directly related to the key generation rate [see 
Eqs. ([27]), (Ell), and ^3TJ)]. 

There has been much interest in security proofs of QKD based on fundamental principles 
such as no-signaling faster than the speed of light and Bell's inequality violations [37,38]. 
In particular, the idea of device-independent security proofs has been proposed. So far a 
complete proof of security along this line is still missing and such a proof idea only applies 
to specialized attacks such as collective attacks. We remark that this paper, following our 
earlier time-shift attack papers [27,28], serves to highlight a fundamental weakness of device- 
independent security proof. Even if such a proof can be constructed in future for the most 
general attack, it will not apply to most current practical QKD set-ups. This is because of the 
existence of detection efficiency loophole and Eve's potential ability to manipulate signals in 
the auxiliary domain to bias the relative detection efficiency between two detectors. (Notice, 
however, that, as we will show in Sec.[6l a four-phase setting idea can equalize the detection 
efficiency of two detectors.) 

This paper is organized as follows. In Sec. El we give an overview of the physical origin of 
detection efficiency mismatch and how Eve might exploit this mismatch. We then introduce 
our detector model in Sec [3] In SecHJ we consider the security proof for the noiseless case, in 
which Eve does not introduce any bit or phase errors but only intervenes with the auxiliary 
dimension. The study of the noiseless case is instructive as it illustrates clearly our proof 
technique that is shared across both the noiseless and noisy cases. In Sec. [SJ we provide the 
unconditional security proof for the noisy case, in which Eve introduces bit and phase errors, 
in addition to intervening with the auxiliary dimension. In Sec. [51 we show how randomly 
switching the bit assignments of the two detectors for each quantum signal (similar to the 
scheme proposed by Refs. [31,32]) can completely eliminate the effect of detection efficiency 
mismatch. In Sec. [71 we discuss how to handle multi-photon signals in our proof, with the 
help of the results of other papers. Finally, we conclude in Sec. [3 
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Fig. 1. Mismatch in efficiency between two detectors. Due to the asymmetry between the two 
detection channels the time responses of the two detectors may not be identical. Under normal 
operation, signals are expected to arrive at time 0. On the other hand, Eve can launch a "time-shift 
attack" in which she shifts the arrival times of the signals to say times t_ or t+ in order to subject 
the signals to different probabilities of being detected as bit "0" or bit "1" . Thus, because of this 
difference in the detection probabilities of bit "0" and bit "1", Eve can learn some information 
about the key. 

2 Practical detection efficiency mismatch and attacks 

In this section, we consider detection efficiency mismatch in realistic QKD setups and possible 
attack strategies that are based on detection efficiency mismatch. Without a security proof 
that takes into account of detection efficiency mismatch, these attacks may compromise the 
security of QKD systems. The security proof provided later in this paper takes detection 
efficiency mismatch into account and allows Alice and Bob to defeat these attacks. 

2.1 Time-domain detection efficiency mismatch 

In a typical fiber-based QKD system operating at 1550nm wavelength, in order to minimize 
the effect of dark counts, the two InGaAs detectors are usually gated to be active in a narrow 
time window in which signals are expected to arrive. However, due to the different responses 
of the two detectors and also the asymmetry between the two detection channels, the detectors 
may have different efficiencies over time. Fig. [T] illustrates a mismatch in efficiency between 
two detectors. Typically, the open windows of the two detectors are larger than the width 
of the laser pulses. Thus, under normal operation, the signals arrive near the centre of 
the two open windows so that the efficiencies for detecting bit "0" and bit "1" are similar. 
However, it is possible for Eve to time shift the input signals to Bob causing a mismatch in 
the efficiencies. In Ref. [27], we proposed a "time-shift attack" that basically draws on this 
efficiency mismatch due to time shifting. Essentially, Eve time shifts the signals entering Bob 
to say time t-. Whenever Bob announces that he has a detection, Eve knows that it is likely 
that detector has clicked because it has a higher efficiency at time i_. Thus, Eve obtains 
some information about the bit value. In the extreme case that at a particular time shift, the 
efficiency of one detector is positive and efficiency of the other detector is zero, Eve knows the 
bit value exactly because only one detector can ever produce a click. Standard security proofs 
that ignore efficiency mismatch may allow Eve to steal information in this way. On the other 
hand, the security proof provided in this paper takes this mismatch into account and applies 
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enough privacy amplification depending on the mismatch to remove Eve's information. We 
remark that a successful experimental demonstration of this attack has been performed by 
us [28]. 

Note that when multiple pulses arrive in the same detection window, the efficiency of 
the detection system may depend on the relative phases of these multiple pulses. This may 
happen when there exist multiple reflection sites in the detection channel. We will establish 
a detector model in Sec. |3] that is general enough to incorporate this correlation. 

2.2 Space-domain detection efficiency mismatch 

The space-domain efficiency mismatch is related to free-space QKD systems [39-46] where a 
change in the spatial mode of the input light may affect the efficiencies of the two detection 
channel differently. In order to illustrate this concept, we show in Fig. [5] a simple detection 
setup. Here, the two output lights of the beamsplitter pass through the optical coupling 
systems before being detected. In practice, there exists asymmetry between the two free- 
space to fiber coupling systems. For example, the distances between the coupling systems 
and the beamsplitter may not be identical and also the lenses of the coupling systems may 
not be perfectly aligned with respect to the beamsplitter. If Eve changes the spatial mode 
of the input laser beam (e.g., angle, lateral displacement), the losses in the two coupling 
systems can potentially be different, leading to detection efficiency mismatch which Eve can 
take advantage of. Let's consider an extreme example. Suppose that the two single-photon 
detectors (SPD's) are identical, but the distance from the collecting lens of channel 1 to the 
beamsplitter is twice the distance from the collecting lens of channel 2 to the beamsplitter 
(see Fig. [2]). In this case, if Eve changes the angle of the input laser beam, the resulting 
lateral displacement of the laser beam at the surface of the lens of channel 1 is twice that at 
the surface of the lens of channel 2. Thus, this induces higher efficiency for channel 2 than 
for channel 1. In free-space QKD setups, four detectors are often used with passive basis 
selection. In this case, it is conceivable that Eve manipulates the spatial mode of each signal 
and thereby produces a bias towards one basis use. 

In practice, the process of free-space optical alignment is quite complicated, with many 
factors contributing to the coupling efficiency. Also, errors in the manufacturing process of 
optical elements can lead to variations in the coupling efficiency. Spatial change to the input 
laser beam can further enhance the variations. Thus, it is expected that a spatial attack can 
be used to effectively create efficiency mismatch. Also, note that coupling efficiency mismatch 
does not vary with time, which liberates Eve from dealing with time-dependent issues. 

2.3 Frequency- domain detection efficiency mismatch 

In a similar way, detectors may respond to different wavelengths with different efficiencies. 
Thus, in principle, Eve may shift the frequency of the incoming signals at Bob to launch her 
attack. An acousto-optic modulator can be used to shift the frequency of the input signal up 
to a few GHz. On the other hand, by employing nonlinear optical materials, the wavelength 
of light can be shifted by a few hundreds nm [47] . 

Wavelength filters can be used to ensure that only photons within certain spectral band 
are permitted to reach the SPD's. However, one must be careful about the placements of 
the filters. If a separate filter is placed before each SPD, Eve may still be able to exploit 
some efficiency mismatch, since the spectral responses of the two wavelength filters may not 
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Fig. 2. Eve changes the incident angle of the input laser beam. Since the distance between 
collecting lens 1 and the beamsplitter is not the same as the distance between collecting lens 2 
and the beamsplitter, the laser beam arrives at different lateral displacements on the surfaces of 
the collecting lenses, causing different losses and in turn a mismatch in the detection efficiencies. 
Thus, because of this difference in the detection probabilities of bit "0" and bit "1" , Eve may learn 
some information about the key if Alice and Bob are not aware of this mismatch. 

fully overlap and thus shifting in frequency may still lead to different efficiencies. Thus, one 
simple counter measure is to place one wavelength filter at the entrance of Bob's system. 
Conventional SPD's based on Si-APD or InGaAs-APD have a spectral response range of a 
few hundreds nanometer, while the bandwidth of a narrow-band filter may be f nm. Thus, 
the responses of the SPD's may be regarded as identical. On the other hand, other types 
of SPD's, such as the up-conversion SPD's, may have a bandwidth less than f nm due to 
the requirement of phase matching in the up-conversion process. In this case, a wavelength 
filter with a bandwidth of I nm may not be able to eliminate the efficiency mismatch and the 
SPD's may still respond differently to photons with different wavelengths (especially when 
the wavelengths of the input photons get close to the edge of the spectral response window); 
thus, a spectral attack may still be possible. 

3 A general detector model 

In this section, we describe a model for detectors in a QKD system that is general enough to 
cover a wide variety of efficiency dependencies. Our security proof with efficiency mismatch 
taken into account will be built on this detector model. Fig. [3] shows a QKD system with 
two detectors having efficiencies dependent on some auxiliary dimension (which, in this case, 
is time). We are interested in constructing a POVM (positive-operator- valued measurement) 
for Bob's detector package for detecting bit "0" and bit "I", taking into account the im- 
perfect efficiencies. Bob's detector package accepts two systems as input: system B for the 
qubit representing the information-carrying qubit state of the QKD protocol, and system T 
representing the auxiliary domain (e.g. time, space, and frequency) related to the detection 
efficiency. 

Before we begin the construction of the POVM of Bob's detector package, we state a 
few assumptions. We assume in the proof that Eve always sends single-photon signals to 
Bob (see also Sec. 17.11 for handling multi-photon input signals). Furthermore, she sends Bob 
a qubit state in system B. Dark counts in the detectors may be modeled by Eve sending 
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Fig. 3. There are two detectors in the QKD system, one for detecting bit "0" and the other 
for detecting bit "1". The two detectors have different efficiencies and their efficiency responses 
are characterized by matrices Fo* Fq and Fi^Fi- fn this example, the efficiencies depend on the 
arrival time of the incoming signals, and the diagonal elements of i^'-Fj expressed in the basis that 
represents the arrival times are plotted in the figure on the right. The data of this figure comes 
from an actual experiment that we performed to demonstrate the time-shift attack [28]. 

random qubits. In addition, we assume that in the detector model there is no coupling 
between the information-carrying qubit system and the auxiliary system. This means that in 
the detection process, information decoding operations (such as beam splitting) on the qubit 
system is not affected by the auxiliary system. This model is not the most general one but 
is consistent with the three detection scenarios we described in Sec. [2l This can be seen by 
noting that information bits "0" and "1" (encoded in polarization or phase) are discerned 
by a beam splitter separating the incoming signal into two paths, and the beam splitter acts 
independently of the arrival time, frequency, or spatial mode of the signal. Thus, we can 
assume that the POVM elements take a tensor product form in the qubit system and the 
auxiliary system. 

We now characterize the POVM of the whole detector package consisting of two detectors. 
Let's first focus on the Z-basis measurement by Bob. In this case, the POVM elements for 
measuring bit "0" and bit "1" can be represented by 

M = \0,) B (0,| <8> (F$F )t (1) 
M 1 = \1 z ) b {I z \^{fIf 1 ) t (2) 

where F^ Fi represents the efficiency matrix of detector i that we will discuss in the following. 
Thus, the POVM of Bob's measurement is {Mq,M x ,1- M ~ Mi}, where the last element 
represents the case of not getting a click by Bob. In the special case that the two detectors have 
constant efficiencies, F^ Fi = rji becomes a scalar and Bob's POVM elements for conclusive 
events become Mi = rji \i z ) B (i z \ ,i = 0, 1. For the later use, it is convenient to express Bob's 
measurement as a filtering operation followed by a simple measurement. The filtering is 



= \0 Z ) B (0,| ® (F )t + \W B (1,| ® (Fi)t 



(3) 
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and it is followed by the measurement {|0 Z ) B (0 2 | ® It, |1z)b (lz | ® It}- In a similar way, 
Bob's A-basis measurement can be defined as the filtering operation 

F x = |+M+|®(Fo)T + |-M-|®(*i)T, (4) 

followed by the measurement {|+} B (+| <8>It, \~)b ( — I <8>It}- I n Eqs. ©-HI), we have ignored 
the possibility of double click events, in view of their low probabilities. However, as noted in 
ILM [16] and GLLP [17], one should assign random probabilities to double click events. 

The POVM corresponding to detector i consists of two outcomes {F^Fi, I—F^Fi}, where 
the first (second) element corresponds to having (not having) a detection. Thus, when the 
input to detector i is p in the auxiliary domain, the probability of detection is Tr (pF^ Fi). In 
general, the efficiency response F^ Fi is a full matrix: 



rji(h,ti) ■■■ Vi(h,td) 



(5) 



This is because there may be a natural or convenient basis to represent it (e.g. Fi may be 
expressed in the basis in which one tests the detectors). Here, we assume that the auxiliary 
domain has a finite dimension d and it is known to Alice and Bob. Also, note that the two 
detectors may not be diagonalizable in the same basis. 

One example of the auxiliary domain is the arrival time of the signal (see Fig. |3]) . The 
efficiency of gated single-photon detectors can be sensitive to the arrival time of the signals 
and the efficiency response F^ Fi is conveniently represented in the basis of arrival times. 
Thus, one may regard the diagonal term r)i(tj,tj) as the efficiency of detector i at time tj, 
and the dimension d is the number of allowable time shifts. 

In many cases, one may completely characterize the detectors' responses Fi (with both 
diagonal and off-diagonal terms). For example, when the auxiliary domain is polarization, the 
dimensions of Fi is 2 x 2, and its elements can be found by sending signals to the detector with 
vertical polarization, horizontal polarization, and the in-phase and out-of-phase superpositions 
of vertical and horizontal polarizations. On the other hand, when the auxiliary domain is time, 
there would be infinitely many uncountable time shifts and the dimensions of Fi would be 
infinite. Thus, it may appear that perfect characterization is difficult. However, with a small 
adjustment, the case of time-dependent efficiency can still be treated with finite dimensions, 
as we discuss next. 

3.1 Time- dependent efficiency 

3.1.1 Characterization with a finite number of samples 

Let us consider that the detectors have an efficiency dependent on the arrival time of the sig- 
nals. This is the case for detectors operating in gated Geiger mode (e.g., see our experimental 
time-shift attack paper [28] for how practical efficiency mismatch is exploited by Eve) . When 
time is the auxiliary dimension, the efficiency response matrix F^ F$ becomes continuous and 
contains uncountable elements. This may be problematic to our analysis. However, with an 
additional minor assumption, this problem can be resolved and we can characterize iv Fi 
with a finite number of elements. 
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Fig. 4. An input signal can be split into more than one pulse by using beamsplitters. The phase 
modulators control the the relative phases between these multiple pulses. One may repeat this 
setup many times to get a superposition of many pulses. 

The key assumption is that a narrow-band Gaussian-shaped frequency filter is installed at 
the entrance of Bob, with the center frequency matching that of the quantum signal. Thus, the 
incoming signals are filtered before reaching the detectors. The main idea is that the signal 
after the narrow-band filter must also be narrow-band. Thus, according to the Nyquist- 
Shannon sampling theorem [48] , a narrow-band signal can be fully represented by its discrete 
samples. This means that the input to the detector can always be represented by a series 
of pulses located at fixed time instants, and thus this allows us to characterize the efficiency 
response of the detector only at those fixed time instants. Furthermore, when we consider the 
gating window to have a fixed length, we can characterize the detector with a finite number 
of pulses sent within the gating window. Therefore, with an addition of a frequency filter, the 
characterization of the time-dependent efficiency of the detectors becomes discrete and finite- 
dimensional, and thus is readily applicable to our security proof. The details are analyzed in 
Appendix [5] Note that the use of a Gaussian-shaped frequency filter facilitates the use of 
Gaussian pulses to test the detectors, and Gaussian pulses are easy to generate in practice. 
By the same token, adding a time filter makes the characterization of frequency-dependent 
efficiency discrete. 

We remark that the detector and its efficiency response FfFi do not change with time. 
What is time dependent is that the detector's efficiency depends on the arrival times of the 
input signals relative to the detector trigger in a gating window. 

3.1.2 Practical setup for characterization 

Here, we discuss how to test the time-dependent efficiencies of a detector, denoted by F^Fi. 
Suppose that we choose a basis for iv Fi such that its diagonal elements represent the arrival 
times of the incoming signal. In this basis, the diagonal elements can be tested easily by 
sending signals into the detector at different times. The separation between two adjacent test 
times is determined by the bandwidth of the frequency filter as discussed above, and the test 
pulse shape should ideally be Gaussian with a width also determined by the bandwidth of the 
filter. The off-diagonal elements can be found by sending in signals in superpositions of the 
test times with different phases. One possible practical setup to generate superpositions of 
the test times is shown in Fig. [4j Ideally, one should test the detector using a single-photon 
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source, since this is consistent with the assumption we use in this paper that Eve always sends 
single-photon signals to Bob. In principle, the off-diagonal terms may not be zero, since it is 
conceivable that there exist multiple reflection sites in the detection channel that can give rise 
to correlations between pulses of different arrival times. However, in practice, we speculate 
that the multi-reflected signals are much weaker than the original signals, and therefore the 
off-diagonal terms may be negligible compared to the diagonal terms. It would be interesting 
for future study to test practical detectors for the existence of this correlation. 

4 Security proof for the noiseless case 

In this section, we prove the security of the case where Eve does not introduce any bit or 
phase errors but only intervenes with the auxiliary dimension. Since we assume Alice uses a 
single-photon source, the initial state prepared by Alice is 

(|00> + |11» AS . (6) 

Eve does not introduce any noise and she simply attaches an extra system T that represents 
her intervention in the auxiliary dimension, giving 

— ►(|00> + |ll»Ai J ®hW (7) 

Note that the state in T is in general mixed, and thus is purified with system E in this 
representation. Now, the state in BT is sent to Bob and he performs the filtering in Eq. ([3]) 
to get 

— |*l) = *M(|00> + |11»ab®|7> TB ] 

= I+>a[|0>b^o|7>tb + |1>b^I7>tb]+ ( 8 ) 
!-M|0) b Fo|7>t £ -|1} B ^iI7} T£ ;] 

where Fi acts on system T. In the actual protocol, after the filtering operation F z , both 
Alice and Bob perform measurements on their systems in the Z basis to obtain their raw 
keys. Bob corrects the bit errors in his raw key according to the error syndromes sent by 
Alice through a secret classical channel, thus making Alice's and Bob's raw keys the same. 
After this error correction step, they multiply the same random matrix to their raw keys (for 
privacy amplification) to arrive at the final secret key. The essence of Koashi's proof [18] is 
that since the final secret key is derived from Alice's raw key obtained in the Z basis, Alice 
and Bob's main goal is to guarantee that system A of Alice is in an X eigenstate. In this 
case, because the uncertainty of system A in the X basis is minimized, by the uncertainty 
principle, Eve's uncertainty of system A in the Z basis is maximized, and thus the final key 
is secret to Eve. 

Thus, to prove security using Koashi's proof, we consider that Bob performs a virtual 
measurement on system BT in order to predict Alice's X-basis measurement outcome on 
system A (see Fig. |5(b)| . Essentially, system T (though not carrying bit information) acts as 
a shield [36] that protects Alice and Bob's key from Eve. Loosely speaking, the uncertainty 
associated with using Bob's virtual measurement to predict Alice's A-basis measurement out- 
come is related to Eve's information on the key before privacy amplification. The advantage 
of using Koashi's proof is that there is no restriction on Bob's virtual measurement on system 
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Fig. 5. The top figure shows the actual measurement by Bob to general key bits in the Z-basis, 
with the corresponding bit error rate of ej,. The middle figure shows the virtual measurement by 
Bob for helping Alice predict her Jf -basis measurement outcomes on system A for the key bits 
generated from Z-basis measurements, with the corresponding (virtual) phase error rate of e p . 
The bottom figure shows the actual measurement by Bob in the X-basis, with the corresponding 
(actual) phase error rate of e' p . 



BT. He is allowed to perform any quantum measurement after the filter F z . This measure- 
ment is not performed in practice and thus whether it is physically realizable is not a concern. 
The only concern (or restriction) is that we have to make sure that statistics of virtual proto- 
col can be well estimated using those of the actual protocol. Thus, we would like to construct 
a virtual measurement for Bob aiming at predicting Alice's X-basis measurement outcome 
with high certainty. 

Procrustean method of filtering for Bob 's virtual measurement 

The objective for Bob is to distinguish the two non-orthogonal states in system BT corre- 
sponding to Alice's |+) and |— ) states in Eq. ©. The non-orthogonality stems from the 
efficiency mismatch between the two detectors and this makes the problem more difficult 
than the perfect-detector case. What complicates the problem even further is that the state 
Bob tries to measure is not known a priori, owing to the fact that the initial state in system 
T is unknown. Nevertheless, we propose a simple way to identify the two non-orthogonal 
states, which is by orthogonalizing them with a filter that may succeed with a probability less 
than one. The idea of orthogonalizing each signal independently is known as the Procrustean 
method of filtering [49] . Although our filtering method may not be optimal since we are oper- 
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ating on individual signals independently, it does provide a simple and intuitive method that 
magically orthogonalizes the two states even though the initial state in system T is unknown. 

In this paper, we specialize in a trick to constructing such a virtual measurement by 
inverting the filtering operations Fi in Eq. §E§ as follows. Bob first performs a filtering 

Get = \0 Z ) B (0,| ® {CF 1 ) T + \l z ) B (1,| ® {CF^) T (9) 

on system BT of Eq. {5} and then performs an X-basis measurement on system B (i.e., with 
POVM {|+) B (+| ® It, \—)b (~ I ® It})- Here, we introduce a d x d matrix C to ensure that 
Gbt is a valid filtering operation (i.e., C is chosen so that G bt Gbt < I)- See Appendix [Bl 
for the derivation of C. 

After applying this filter Gbt to Eq. ([8]), the whole state becomes 

— > Gbt 

= [\++)ab + \— )ab\®C\ 1 ) te . (10) 

where C acts on system T. The magic of the filter Gbt is that even though the initial state 
of system T is unknown, the filter is still able to concentrate an perfect EPR pair in system 
AB. Since now there is an EPR pair in system AB, an A"-basis measurement outcome on 
system B is perfectly correlated with an X-basis measurement outcome on system A. Thus, 
when Bob measures in the X basis on system B of the successfully filtered state in Eq. (fTU]) , 
he is able to predict Alice's X-basis measurement outcome with complete certainty, and this 
is enough to prove security. Once Alice and Bob know that Alice's state is an X eigenstate, 
the final key derived from the Z-basis measurements of Alice's state is then secret to Eve. 
The probability of successful filtering is 

Tr{G B T\*i)(t>i\G BT } 
Psucc 7V[|*i)<*i|] 

2( 1 \(C^C) t ^Ie\i) te 

(i\(fZf + f1f 1 ) t ®i e \ 1 ) 

Therefore, among all the N qubit pairs shared by Alice and Bob, Bob is able to predict 
Alice's JT-basis measurement outcomes of Np succ key bits, since he knows whether the virtual 
filtering on each bit succeeded or not when it is performed. By applying the arguments of 
Koashi's proof, the secret key generation rate is simply j? SU cc- Since the state I7) in Eq. (|12p 
is chosen by Eve, the worst-case final secret key generation rate on detected signals is 

^noiseless = max min p succ , (13) 

c It) 

which is a lower bound on the key generation rate. The detectors' efficiency matrices FqFq 
and i^iq are assumed to be known. In this case, the final secret key generation rate on 
detected signals is found by solving Eq. (fT3|) (see Appendix [B] for detail) and it is equal to 



(11) 
(12) 
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where D = diag(Z?i, . . . , Dd) is a diagonal matrix with positive real elements (which are the 
eigenvalues) and is determined from the Hermitian decomposition of Fo(F±Fi)~ 1 Fq = UDW . 
The elements of D represents the ratios of the efficiencies of the two detectors and when the 
assignment of Fq and F\ is reversed, D would also be inverted. If the efficiency matrices Fi 
are only partially known, one can find the worst-case key generation rate by also minimizing 
Eq. (|13p over them. Throughout the derivation, we have assumed that Fq and F± have full 
rank (or invertible). Otherwise, we can show that the key generation rate is zero (see below). 
Thus, characterization of the detectors is very important. 

Special case 1: Fi is not invertible 

Suppose that Fq is not invertible (i.e., not full rank) and the nullspace of Fo and that of iq are 
diffcrenJ c (Fi may be invertible). In this case, the worst-case final key generation rate is zero. 
One may observe this from Eq. ijHJ). Eve may choose I7) to be in the nullspace of -Fo and not 
in the nullspace of Fi, leading to system A completely disentangled with system B. Thus, no 
key can be generated in this case, since entanglement is a precondition for generating secret 
keys [50]. 

Special case 2: only diagonal terms are known 

Note that if only the diagonal terms of FqFq and F^Fi are known, the worst-case final key 
generation rate is zero. Since only the diagonal terms are known, the final key generation 
rate is determined by minimizing over the off-diagonal terms. One can imagine that the off- 
diagonal terms are chosen such that Fq is not invertible and iq is invertible. Thus, this case 
is reduced to special case 1, which allows us to conclude that the final key generation rate in 
this case is zero. 

Special case 3: Fq and iq are diagonal 

Here, we consider the special case that the Bob's detectors' responses to the time-shifts, 
F^ Fi, i = 0, 1, are diagonal, i.e., there is no correlation in the efficiencies between time-shifts. 
Suppose the efficiency matrices are Fi'Fi = di&g(r)i(ti) , ^(£2), • ■ ■)■ We compute the final key 
generation rate using Eq. (H}. Note that FoCi^iq)" 1 ^ = diag ■ • •) ■ Using 

this fact, the final key generation rate on detected signals is 



2min(7? (t),T?i(f )) 



R - rnin 111111 V'/O W TO / 1 k\ 

-n-noisclcss, diag — mm ZT77\ i Z 77\ ' \ 10 ) 



5 General security proof 

In this section, we prove security under the most general attack by Eve in which she can 
coherently process the signals sent by Alice and perform a joint measurement on her ancillas. 
In this general case, Eve's action on the Ith bit can be described by her preparing a pure 
state system T (the auxiliary domain to which the detectors respond) and performing a 
superoperation on both systems B and T, as follows: 

l^ } > = J2 E BT(\ QQ ) + \ n )UB®\0) T ®\i) E (16) 



c If Fq and Fx have the same nullspaces, then they can be reduced to two invertible matrices. 
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where E B ' T is the operation element for the ith bit and it is responsible for introducing bit 
and phase errors. Note that it can depend on Eve's action on all other bits. Now, the state 
in BT is sent to Bob and he performs the filtering in Eq. ([3]) as in the noiseless case to get 

— > F z |*<*>) . (17) 



As in Fig. |5(b)| in order to estimate the amount of privacy amplification, we assume that 
Bob performs the virtual measurement by applying a filter to F z )• Bob applies the same 
filter Gbt in Eq. Q as in the noiseless case and we have 

— |*«) = GbtF,]*®). (18) 



Thus, after Bob measures in the X basis on system B of the successfully filtered state in 
Eq. (| 18(1 , he is able to predict Alice's A-basis measurement outcome with uncertainty indicated 
by the virtual phase error probability of [^3 )■ On the other hand, the actual phase error 
probability (e' p ) is not generated by this state; it is generated by some other state, namely 



F x l^^} Pig- 5(c) . Thus, we need to estimate the virtual phase error probability (e p ) of 



the filtered state ) [Fig. 5(b)| from the actual phase error probability (e' p ) [Fig. 5(c)] . In 



addition, we need to lower bound the probability of successful filtering of the state F z '). 

Overall, we are interested in the formulas for the actual bit error probability (e&) of F z 

the virtual phase error probability (e p ) of |\&3 ), the actual phase error probability (e') of 



F x YS> ( 2 ] ), and the virtual filtering probability (p. 



succ, noisy 



) of F 2 ll- 



-'succ, noisy 



>(0\ 



(0 



Ei(*3 } 1*3°) 



(19) 
(20) 

(21) 
(22) 



where P bit - |01) AB (01| + \10) AB (10| and F phasc = |+-) AB (+-| + (-+|. These 

quantities are specified by Eve through her selection of the attack strategy Egj) . Although 
there seems to be many dimensions in the attack strategy (as I runs over all qubit pairs 
and i over any range), one can simplify the attack into a small number of dimensions when 
probabilities are concerned. 

For the case we consider in this paper, it is shown in Appendix [Cl that the various proba- 
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bilities of interest in Eqs. (|19 | - ([22|) can be simplified with a collective attack to 

Tt[ Pe {Z w g Fph + Z 01 ® FlF 1 )} 

db = ~ = + ~ ~ + (^o) 

Tr[ PE ((Z 00 + Zio) ® F*F + (Z u + Z 01 ) F/fi)] 



Tr[ /0i; (X_ + +X + _)^Ctq 
Tr[p£;(X ++ + X_+ + X+_ + <g> CtC] 



(24) 



u succ, noisy 



e , = Tr[p £ (l_ + Fpp + X + _ g F/FQ] 

6p Tr[p £ ((l ++ +X_ + )®F t F n + (l__+l + _)®F 1 t F 1 )] 

Tr[p E ((Z o + Zi + Z n + Z Q1 )® &C)\ 



Tv[p E {{Z 00 + Z w ) ® FjFo + (Zn + Z i) ® fJFi)] 

where p^; represents Eve's action, which is averaged over all signals, and has dimensions AdxAd 
(again, d x d are the dimensions of F, and C) and C is from Eq. (|B.16j) . Here, Zi t j and Xy 
are constant 4x4 matrices given in Eq. (IC.11|) . [Note that we are using C determined in the 
noiseless case. However, it can be shown (in a similar fashion as in the noiseless case) that 
the same C is obtained if we maximize the filtering probability p S ucc, noisy over C (which is 
related to problem (IP1'|1 in Section l5?2|) .] 

It is worth noting that the security proofs for a three-state protocol [51] and the SARG04 
protocol [52,53] that share the same technique (the Azuma's inequality [54]) as the current 
paper reduce to collective attacks in a more straightforward manner. In their cases, the nor- 
malizations of all probabilities of interest (the bit and phase error probabilities) are the same 
and this together with the concavity of the relations between the probabilities immediately 
reduce joint attacks to collective attacks. In the case of the current paper, the normalizations 
(i.e., the denominators of Eqs. (TiTH) - (f2"2"|) ) are different; and thus we need a more involved 
analysis to reduce to collective attacks. 

We remark that in our general method, we use the Procrustean Method and the trick 
of inverting the detection efficiency filters when constructing the virtual filter. It is well- 
known (e.g. Ref. [49]) that in entanglement distillation theory the Procrustean Method is, in 
general, sub-optimal. On the other hand, our method, despite its sub-optimality, provides an 
instructive and easily understandable way to prove security. 

5. 1 Bounding filtering probability p SUCCj no i sy and phase error probability e p 

Both the virtual filtering probability (p SUC c, noisy) and virtual phase error probability (e p ) ulti- 
mately determine the key generation rate (cf. Eq. (|31|l ). Thus, we bound them by numerically 
optimizing them over Eve's action subject to the observed bit and phase error rates. One 
important tool that we rely on to identify the the observed rates with the corresponding prob- 
abilities is the Azuma's inequality [54] , which asserts that the sum of the probabilities for an 
event over all trials is asymptotically close to the observed count of the event (this inequality 
was similarly used in other security proofs [51-53, 55, 56] J? Thus, the rate of successful virtual 

d In order to see how the Azuma's inequality is applied to Eqs. I|19ll - I|22[ l. consider e^ in Eq. I|19j l as a concrete 
example. We apply the Azuma's inequality to the numerator and denominator separately. The numerator in 
the right hand side of Eq. (1 1 9 I t is Pr{bit error and conclusive result} and the denominator is Prjconclusive 
result}. Since et is defined as the bit error rate conditional on conclusive bits, we can apply the Azuma's 
inequality to the numerator of Eq. H19I I to get the actual number of bits with error and apply the Azuma's 
inequality to the denominator to get the actual number of conclusive bits. Dividing these two numbers gives 
us e;,. 
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filtering can be lower bounded as 



minimize p SU cc,noisy 
subject to eb = observed ej, 
e' = observed e' 



(PI) 



and the virtual phase error rate can be upper bounded as 



maximize e, 



p 



subject to eh = observed eb 
e' = observed e' 



(P2) 



where the optimization is over Eve's action pe and the formulas for the error probabilities and 
the filtering probability are from Eqs. (j23]) - (l2"6]) . Note that both problems (|P1[) and (|P2|) can 
be expressed as a polynomial problem by multiplying the denominator of each fraction in each 
of the constraints; and thus the two problems can be solved numerically and efncientljf^TjSS]. 
When eh = 6p = 0, solving these two problems gives the same noiseless-case result in 

E q . mm. 

When Fq — F\ (meaning that there is no efficiency mismatch), it can easily be checked 
that Psucc, noisy = 1 and e p = e' , as expected. 

We remark that although both problems (|P1|I and (|P2|) involve only the average error 
rates, improvement in the bounds may be obtained by, for example, separating the error rates 
for bits "0" and "1". 

5.2 Suboptimal bounds 

In order to better understand the relationship between the efficiency mismatch and the phase 
error probability e p or the filtering probability p SUC c, noisy, we compute suboptimal bounds 
for these two quantities. These bounds are obtained by simply dropping the constraints in 
problems (|P1[) and (|P2[) . Specifically, we solve 



where the optimization is over Eve's action pe and the formulas for the error probabilities and 
the filtering probability are from Eqs. ([23]) - (f26)) . Solving these problems gives (see Appendix ID1 
for detail) 



minimize p, 



(PI') 



and 



maximize -7- 



(P2') 




(27) 



(28) 



e It seems that considering rank-one is always sufficient to achieve the optimal solution based on our 
simulation results. However, we have not been able to prove this. Note that convexity/concavity of (I F 1 b / (IF 2 1 ) 
does not immediately give rise to this conclusion. 
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where D = diag(Z?i, . . . , Dd) is a diagonal matrix with positive real elements and is determined 
from the Hermitian decomposition of Fq(F^Fi)~ 1 Fq = UDW . In other words, the virtual 
filtering probability and the virtual phase error probability are related to the minimum and 
maximum efficiency ratios between the two detectors. Note that the right hand side of Eq. (|27]) 
is the inverse of that of Eq. (|28l) . 



5.3 Key generation rate 

After the virtual filtering operation, Bob can predict Alice's A-basis measurement outcomes 
with an error probability of e p for Np SUCCtno i sy key bits. In light of Koashi's proof, Bob's pre- 
diction removes some uncertainty on Alice's A-basis measurement outcomes (through Bob's 
communication to Alice). The remaining uncertainty can be removed (with high proba- 
bility) by Alice performing hashing on the key bits in m rounds, where m is less than N 
in general. In our case, m — (N — Ap SUCCjno i sy ) + Np succ ^ no i sy H2{e p ) where the first (sec- 
ond) part represents the key bits for which Bob's virtual filter did not (did) succeed. Here, 
H%{x) = — a;log 2 x — (1 — x) log 2 (l — x) is the binary entropy function. According to the proof, 
the number of secure key bits generated is (without error correction) 

K PA = N - m 

= Np SUCCtnoisy (l - H 2 (e p )). (29) 

The amount of (pre-shared) secret key bits sacrificed for error correction using encrypted 
one-way communication is 

A EC = NH 2 (e b ). (30) 
Combining them gives the final key generation rate on detected signals: 

^noisy = [K PA -K EC }/N 

= Psucc,noisy(l - H 2 (e p )) - H 2 (e b ) (31) 

where p SUC c,noisy and e p are obtained by solving problems (|Pip and (|P2[) . respectively. Alter- 
natively, they may be obtained from the suboptimal bounds in Eqs. (f27|) and (|28|) . Also, it 
is worth noting that we do not need to separately bound p S ucc, noisy and e p with two separate 
optimization problems. We can instead minimize the key generation rate in Eq. (|3ip subject 
to the observed error rates (which are the common constraints of (|P1[) and (|P2[) ). However, 
this problem is not a convex optimization problem (due to the nonlinear equality constraints) 
or a polynomial optimization problem (due to the non-polynomial objective function) and 
thus may not easily be solved optimally and efficiently. 

5-4 Example 1: scalar efficiencies 

Consider a QKD system in which the two detectors have constant but different efficiencies. 
This means that the detection efficiency matrices, F^Fi,i = 0, 1, are scalar. In this case, one 
can easily compute the noiseless key generation rate on detected signals by using Eq. (fl4|) or 
Eq. mi) to be 

_ 2min(77o,77i) 

^noiseless, scalar , i \^^) 

vo + m 
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where r\i = F^Fi. On the other hand, this formula for the scalar efficiency case can be 
obtained by the following simple argument. Bob can artificially make the efficiencies of the 
two detectors the same by randomly discarding some detection events of the detector with 
the higher efficiency in the data postprocessing step. To arrive at the above formula, suppose 
that Alice sends N signals (with equal numbers of bits "0" and "1") to Bob. Then, Bob will 
detect number of "0"s and number of "l"s, giving the total number of detected 
signals (»7o + 7 7i)- Now, assuming that 770 < Bob discards some of detection events of the 
detector corresponding to bit "1", so that effectively -y^o number of "0"s and ^-r] number 
of "l"s are retained to form the final key (there is no error correction or privacy amplification 
since there is no noise). Thus, the final key length is Nr/o, and dividing this by the total 
number of detected signals gives Eq. (f3"2| . 

Now, let's consider the noisy case. The above simple argument with data discarding can 
also handle the noisy case. After the artificial equalization of the two detection efficiencies, 
the situation Alice and Bob are facing becomes that considered in Shor-Preskill [7] . This can 
be seen as follows. When the efficiencies are scalar, Bob's actual measurement in the M^-basis 
(W = X,Z) is described by the filtering operation F w in Eqs. ©-(HI (which is a diagonal 
matrix in the VK-basis and represents the efficiency mismatch) followed by the standard W- 
basis measurement. Now, the artificial equalization can be described by another filter F w 
which is diagonal in the VK-basis such that F W F W — cl where c is a constant independent 
of the basis W, meaning that data discarding removes the efficiency mismatch in both bases 
while incurring some loss. Essentially, this is the same situation as Shor-Preskill's with a 
basis-independent loss, and thus their key rate formula can be applied. Taking into account 
of the loss, the key generation rate for the data-discarding argument is 

-Rnoisy, scalar, discarding = (^O i ?7l ) ^ 1 — H^p) — H 2 (eb))- (33) 

vo + m 

Here, e& and e p are the error rates after the data-discarding process corresponding to the Z- 
basis and X-basis measurement outcomes, respectively. Also, the standard squash model for 
BB84 [f 7,59,60] can be applied here to handle threshold detectors so that the incoming signals 
can always be treated as qubits and dark counts as random qubits. This data-discarding 
argument in conjunction with the Shor-Preskill's proof bears similarity with our formulation. 
In fact, the equalization filter F x for the A-basis is the same as the virtual filter Gbt in 
Eq. ^ in our formulation. In our formulation, we assume that this virtual filter Gbt is 
not and/or cannot be performed in practice and therefore we estimate the virtual phase 
error rate e p from the actual phase error rate e' p through problem JP2|. On the other hand, 
with the data-discarding argument, this virtual filter is actually performed through the data- 
discarding process. Thus, one can actually measure the "virtual" phase error rate e p directly 
(cf. Fig. 5(b) I without solving problem (|P2p . This means that our estimation of the virtual 
phase error rate e p may be sub-optimal, and, in contrast, the data-discarding protocol allows 
us to obtain it directly and accurately. Therefore, the data-discarding protocol may give us a 
higher key generation rate than our general method. A similar argument goes for the successful 
filtering probability p SU cc,noisy This quantity can also be obtained without solving problem 
(IPI|) since the virtual filter Gbt is actually performed. On the other hand, an analogous 
argument does not apply to the bit error rate since, in our formulation, no filtering is applied 
to the states to be measured in the Z basis, whereas, in the data-discarding argument, the 



20 Security proof of quantum key distribution with detection efficiency mismatch 



data-discarding filter F z is applied. In summary, the difference between our formulation 
and the data-discarding argument is that we assume that the virtual filter is not performed 
in practice. By actually performing the filter, the data-discarding argument avoids solving 
problems (|P1|) and (|P2|) . Nevertheless, one may proceed to solve problems (|P1|) and (|P2j) 
with an addition constraint that Eve's attack is symmetric between bits "0" and "1" in both 
bases to obtain e p = e' p and p SU cc, noisy = 2 ^£^2i23J _ Using these results, our formulation in 
Eq. ([3"Tj) gives the key generation rate 

2min(77 ,?7 1 ) 

-Knoisy, scalar — ; (i — J^2(e p )) — tl2(eb)- (,o4j 

V0 + m 

Note that the bit error rate e& here corresponds to that before data discarding. By comparing 
Eqs. (j3"3")) and (|34[) . we can see that the data-discarding argument gives a higher key generation 
rate than our general technique when the bit error rate remains the same before and after 
data discarding. Nevertheless, this simple data-discarding argument does not extend to the 
general case with non-scalar efficiency matrices, whereas our general technique can handle 
this general case. 

5.5 Example 2: two-dimensional efficiency matrices 

In this example, we illustrate the application of our proof to the non-trivial case with non- 
scalar efficiency matrices. Suppose that we have a polarization-coding QKD system in which 
the two detectors have imperfect efficiency responses to the arrival times of signals (assuming 
that only two arrival times are allowed for simplicity). The two detectors have the following 
detection efficiency matrices: 



.8 -.2 
-.2 .4 



f}Fi 



.3 .1 
.1 .9 



(35) 



Here, the basis used to represent these matrices is the arrival times. Thus, for example, the 
first detector responds with 80% efficiency when hit by a signal arriving at the first time 
instant. Also, the fact that the matrices are non-diagonal means that the detectors have 
non-trivial efficiency responses to signals entangled across the two time instants. 

We first compute the efficiency ratios between the two detectors, based on the above two 
matrices. These ratios are the diagonal elements of the diagonal matrix D which appear in 
the key generation rate expressions of Eq. (fl4|) and Eq. (f3"Tj) . The ratios are the eigenvalues 
of FqFq(fIFi)~ 1 and are computed to be 

D x = 3.03, D 2 = 0.356. (36) 

To get the key generation rate in the noiseless case, we substitute D into Eq. (fl4|) and get 

i?„oiscicss = 0.496. (37) 

To get the key generation rate for the general noisy case, we first compute the C matrix from 
Eq. |B~T6j) : 



C = 



0.51 -0.17 
0.12 0.56 



(38) 
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We then use C in the expressions for the various probabilities in Eqs. (|23|) -([26l) and numerically 
solve for p SUC c, noisy and e p in problems (|Plj) and (|P2j) for some given observed error rates. 
Alternatively, one may determine suboptimal values of p S ucc, noisy and e p using Eqs. (f27|) and 
([28| without computing C. Finally, the key generation rate is computed using Eq. (|3Tj) . The 
key generation rate for the noisy case with the assumption of e& = e' p is plotted in Fig. [6] along 
with the corresponding filtering probability and phase error rate. Note that the minimum 
efficiency ratio is 1/D\ = 0.330 and the maximum is D± = 3.03. These are shown as the 
dashed curve of Fig. 6(a) and the slope of the dashed curve of Fig. |6(b)[ respectively. Even 



though the mismatch ratio is quite high, positive key generation rate can still be obtained. 
6 Detection scheme with four phase settings 

In this section, we prove how randomly switching the bit assignments of the two detectors 
for each quantum signal can completely eliminate the effect of detection efficiency mismatch. 
Previously, a four-phase modulation scheme was proposed [31,32] to implement the BB84 
protocol with only one detector at Bob's side. This scheme uses only one detector to measure 
both bit "0" and bit "1" . Essentially, an additional bit flip operation is performed at random 
to prepare the detector for detecting bit "0" or bit "1". So, half of the time, the detector is 
used for detecting bit "0" and the other half bit "1". To implement this method in a phase- 
coding BB84 QKD system, Bob's phase modulator applies four phase settings {0, 7r/2, it, 37r/2} 
instead of the two {0, tt/2} in the normal case. The motivation of the original proposals [31,32] 
for this scheme was to save one detector but not for security purpose. In fact, since only one 
detector is used in this scheme, there is no issue of efficiency mismatch between detectors; 
however, half the bits are lost, lowering the overall efficiency. Moreover, we first pointed 
out [27] that the efficiency loophole could be closed by incorporating the four phase settings in 
BB84 even with two detectors. Here, we rigorously prove this claim. Furthermore, we remark 
that the four-phase scheme can also be used to solve the detection efficiency mismatch problem 
that arises due to dead-times. In the following, we consider using two detectors together with 
the four phase settings in BB84. In this case, the overall efficiency is not affected because 
two detectors are used instead of one. The four phase settings are applied at Bob's side 
to "average out" the effect of the efficiency responses of the two detectors (see Fig. [7]). At 
first sight, the key generation rate of this scheme may appear to be the average of the rates 
when Bob performs the bit flip operation and when he does not. This is because if one 
considers entanglement distillation, the total entanglement available should just be the sum 
of the entanglement of the two cases. However, when we are concerned with key generations, 
Bob's action on whether to flip or not is not known to Eve and thus serves to disentangle 
Eve further (i.e., it acts as a shield [36]). This allows the overall key generation rate to be 
higher than the average of the two cases. In what follows, we show that indeed this scheme is 
capable of completely removing the effect of efficiency mismatch and the key generation rate 
for the no-mismatch case is recovered. 

To begin, let's consider that Bob has a quantum coin that determines whether to apply a 
bit flip operation (which is the same as switching the two detectors). The filtering operations 
F' z and F' x associated with the detectors' responses are (see Fig. [5]) 

F' z = F z ® \0) c {Q\+X B F z X B ® |l) c (l| (39) 
F' x = F x ®\0) c {0\ + Z B F x Z B ® |l) c (l| (40) 
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Fig. 6. Efficiency mismatch example for two-dimensional efficiency matrices. Solid curves are 
obtained from solving problems IjPlll and I)P2J| . Dashed curves are obtained from the suboptimal 
bounds in Eqs. J2TH and H28I I. The key generation rate is computed using Eq. (13 1 D - The maximum 
efficiency mismatch ratio is D± = 3.03. 
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Fig. 7. The diagram on the left is the standard implementation of phase-encoding BB84 with 
a Mach-Zehner interferometer at Bob's side. Bob selects the measurement basis with a phase 
modulator set to either or ir/2. The diagram on the right is the four-phase scheme where Bob 
randomly flips the bit value assignment of the two detectors with a phase modulator. The two 
logical phase modulators can be implemented as one with four possible phases. 



where system C represents the quantum coin, F z is from Eq. ([3]) , and F x is from Eq. (j4|) . The 
entire state after Eve's operation is [cf. Eq. (jC.ip . which does not involve the quantum coin] 



I* 



(0\ 



J^jj^flOO) + ® (|0> + |l» c ® | 7 (M, j)h 



'E ' 



(41) 



1,3 



where Eg'"'' is defined in Appendix [Cl We design the virtual filter Gbt, 4-phasc so that the 
resulting state Gbt, 4-phasc F' z ) [Fig. 5(b)] is the same as the state used to determine the 
actual phase error probability F' x \^) [Fig. [5(c)] . In this way, the virtual X-basis measure- 
ment and the actual X-basis measurement exhibit the same phase error probabilities. 

The state from which the actual phase error rate is estimated is the state in Eq. (j4"Tj) 



filtered with F' x (see Fig. 5(c)): 
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1 \*)e 



where \j) T = \j(l,i,j)) T and aw = a|J; ,J ',W r = {I , X,Y, Z} for simplified notation. Now, 
we design Gbt, 4-phasc so that Gbt, 4-phasc |*i ) is the same as Eq. (|42|) . Notice that 
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We heuristically design G\BT,4-phase = U 2 U\ in two steps. First, we choose 

Ui = \0) B (0| ®I c ®It + \l) B (1| ®X c ®I t (44) 
which is basically a CNOT operation in system BC. This operation leads to 
UiF' z \^) 

= E E b + \ 11 ))ab ® ( |0) c ® F | 7 (1, i, j)) T + |1> C ® Fx | 7 (J, i, j)) T ) ® |i) B • (45) 

Notice the similarity of Eq. (]45f) to Eq. I]4ip which represents the state before the detectors' 
responses are applied. As a special case when there is no noise (i.e., Eg' 1 '^ — I), Eq. (j45|) 
becomes the perfect EPR pair in system AB tensor with system GTE, meaning that applying 
the virtual filter U\ is already sufficient to completely eliminate the effect of detection efficiency 
mismatch. In this special case, the probability of successful virtual filtering is 1 (since Ui is 
unitary) and thus the key generation rate on detected signals is 1. 

Let's continue to design U 2 , which is needed for the noisy case. By choosing 

U 2 =\+) b (+\®Ic®It + \-) b (-\® x c®It, (46) 

one can easily verify that XJ 2 U\F' Z \^^) = F' x Thus, the final virtual filter is G\BT,4-phase = 

U 2 U\. Note that GsT,4-phasc is not F' X F'~ X in general (i.e., we did not invert the filters in an 
naive way). To find the final key generation rate on detected signals, we may use Eq. (|3T|) 
with the probability of successful virtual filtering p SUCCt no i sy = 1 (since GsT,4-phase is unitary) 
to get 

#4-phasc = 1- H 2 (e p ) - H 2 (e b ) (47) 



where e p is the phase error rate estimated using the actual X-basis measurement (see Fig. 5(c) ) 
and eb is the bit error rate estimated using the actual Z-basis measurement (see Fig. 5(a)). 
Apparently, this key generation rate in Eq. |47|) is the same as if there is no efficiency mismatch 
(e.g., Refs. [7,61]). This means that the effect of the efficiency mismatch is completely removed 
by using this four-state scheme. 

7 Multi-photon signals 

In practice, the channel may receive multi-photon signals from Alice and may emit multi- 
photon signals to Bob. We discuss this issue here. 

7.1 Input with multi-photon signals 

Since our detector model and proof work on the assumption that the input to Bob are single- 
photon signals, applying our proof to practice settings where multi-photon signals may be 
present requires special attention. In order to cope with this practical issue, one may consider 
implementing the detector-decoy idea of Ref. [62] to estimate the fraction of single-photon 
input to Bob. The detector-decoy idea involves the receiver Bob adding an attenuator in front 
of his detector to monitor the transmission properties (e.g., transmittance and quantum bit 
error rate) as a function of attenuation. By solving linear equations related to these properties, 
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one can infer the fraction of single-photon input to Bob. Signals received by Bob are randomly 
chosen to be used for this estimation process or the normal key generation process. Upon 
knowing the fraction of single-photon input signals, one can apply the tagged-signals idea 
of [17] to compute the overall key generation rate by assuming that all multi-photon input 
signals are insecure and only single-photon input signals are distillable. Our proof provides 
a way to compute the number of secure bits in the single-photon parts, and this is what is 
needed when we apply [17] to extend the situation with multi-photon input signals. When 
applying our proof in this case, one may also assume pessimistically that all errors come from 
the single-photon parts. Note that when applying the idea of [17], we only need to know the 
fraction of the single-photon input signals but not their positions. 

7.2 Phase-randomized weak coherent source 

Our proof can also be applied to the case with a phase-randomized weak coherent source, with 
or without decoy states [63-70], by following the argument in [17]. Essentially, to incorporate 
both multi-photon inputs and outputs, one estimates the fraction of single-photon input 
signals that originated from single-photon outputs, and applies the result of [17]. 

8 Concluding remark 

In practice, it is hard to build two identical detectors. Owing to widespread existence of 
detector dead-times or different detector responses as functions of some auxiliary variables 
in, for example, time, frequency or spatial domain, two detectors almost certainly exhibit 
detection efficiency mismatch. For practical QKD systems to be secure, it is thus important 
to prove the security of QKD systems with detection efficiency mismatch. In this paper, we 
prove the security of the BB84 protocol when the detectors respond to some auxiliary domain, 
in addition to the qubit space representing the information bit in the normal case. Specifically, 
we show that once the detectors' responses to the auxiliary domain {Fi) are characterized, 
we can obtain an amount of privacy amplification sufficient to remove Eve's information on 
the final key. We show that this amount is directly related to the maximum efficiency ratio 
between the two detectors. 

We show that the detectors' responses Fi can be characterized with a finite number of 
samples even when time is the auxiliary domain by using a narrow-band frequency filter. 
Thus, we may test Fi with a finite number of test signals in practice in order to characterize 
it. One issue about the applicability of our proof is that we assume that the detectors' 
responses Fi are stable over time. Once we have stable estimates of Fi from testing the 
detectors, our proof can be applied to obtain the final key generation rate. 

The key generation rate derived in this paper may not be optimal and there may be ways 
to improve it. Our speculation is based on two observations: one in the noiseless case and 
another in the noisy case. For the first observation in the noiseless case, suppose that the 
two detectors have different scalar efficiencies, i.e. Fi = rji- In this case, the state shared 
by Alice and Bob is |00) + 0jT|ll). Since there are 2 Nll2 ^o/(vo+m)) typical strings, 
the key generation rate is simply /i2('7o/( 7 7o + r /i))j which may be obtained by applying the 
appropriate amount of privacy amplification (see also [49]). On the other hand, our current 
proof yields a key generation rate of 2 min(ryo, Vi)/ (Vo + ^l) ( see Eq. (|15l0 . which is in general 
smaller. For the second observation in the noisy case, we see in Example 1 (see Sec. I5.4[) that 
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a simple data-discarding argument can produce a higher key generation rate than our proof 
(when having scalar efficiencies). Thus, we speculate that there may be ways to improve the 
key generation rate even in the general noisy case where non-scalar detection efficiencies Fi 
are used. The source of sub-optimality of our current proof may be that we distinguish non- 
orthogonal states on Bob's side on each signal independently. Thus, it would be interesting to 
apply a collective method for entanglement concentration, instead of the Procrustean method 
for entanglement concentration, to the context of QKD. We leave this potential improvement 
for future work. 

We have shown rigorously that using four phase settings in BB84 can equalize the detection 
efficiencies for bits "0" and "1", thus solving the detection efficiency mismatch problem. 
However, as noted in our introduction, Eve may try to break this four-state-measuremcnt 
counter-measure by using a combined strong pulse attack and time-shift attack [30,34]. This 
demonstrates that counter-measures may lead to new attacks. 
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Appendix A: Analysis of time-dependent efficiency 

Here, we justify that the efficiency response of a detector can be characterized with a finite 
number of samples when a narrow-band filter is placed before the detector. 

Before we begin, we remark that we will work on the baseband signals, even though the 
signals are modulated to a higher carrier frequency before detection. This is valid because 
practical detectors are not fast enough to respond to the optical frequency of the input signal. 
So only the envelope of the signal, which is equivalent to the baseband of the signal, will be 
detected. Thus, with this built-in demodulation function in the detectors, we can work on 
the baseband signals. 

Suppose that the input (quantum) signal at the detector location is E(t), and the Gaussian- 
shaped frequency filter is g(f) and has an effective bandwidth of B. Since the filter has a 
fixed bandwidth, we can assume without loss of generality that the input signal also has a 
fixed bandwidth B. Then the input signal in the frequency domain can be expressed as 



oo 




(A.l) 
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where h(f) is the perfect rectangular filter with bandwidth B, and the asterisk denotes con- 
volution. Here, we are essentially repeating E(f) indefinitely with a separation of 2B and 
then chopping the spectrum with the low-pass filter h(f). This can be seen by noting that 
E(f)*5(f — 2B) = E(f — 2B). This step may look superfluous, but the reason for this will be 
clear when we look at the time domain. The output of the filter is, in the frequency domain, 

E'(f) = E(f)g(f) (A.2) 

OO 

= [£(/)* S(f-2Bk)]g(f) (A.3) 

k— — oc 

where we have used the fact that g(f) = g(f)h(f). In the time domain, the output is obtained 
through the Fourier transform: 

oo 

E<{t) = (2B)^[E{t) J2 6(t-k/{2B))]*g(t). (A.4) 

k— — oo 

Here, we have used the convolution property of the Fourier transform which says that con- 
volution in the time domain becomes multiplication in the frequency domain and vice versa. 
Also, we used the fact that the Fourier transform of an impulse train is also an impulse train, 
i.e., 

OO OO 

S(f-2Bk)^(2B)- 1 ]T 5{t-k/(2B)) (A.5) 

k—~~ oo fc=— oo 

are a Fourier transform pair. Finally, we expand the convolution in Eq. (IA.4j) to get 

oo 

E'(t) = (2B)- 1 E(k/(2B))g(t-k/(2B)). (A.6) 

k— — oo 

This last equation illustrates the key point, which is that given any input signal E(t), the 
output of the filter can always be represented by a train of Gaussian pulses (possibly with 
different amplitudes) spaced at 1/(2.8) time intervals. Thus, the detector always receives a 
train of Gaussian pulses located at fixed time instants and if the fixed length of the gating 
window is taken into account, one can characterize the detector with a finite number of 
pulses sent within the gating window. Therefore, the detection efficiency response iv-Fi 
effectively becomes finite dimensional. This proves that with an addition of a frequency filter, 
the characterization of the time-dependent efficiency of the detectors becomes discrete and 
finite-dimensional, and thus is readily applicable to our security proof. Note that although 
our analysis does not explicitly involve quantum mechanics, the analysis is still applicable to 
quantum states since the Fourier transform is an unitary transformation (also linear) that 
changes between the time basis and the frequency basis, and the quantities E(f) and E(t) 
can be regarded as the amplitudes of a quantum state in the respective basis. 

Appendix B: Determination of Bob's virtual filter for the noiseless case 

We determine Bob's virtual filter Gbt in Eq. © by finding the matrix C £ C dxd . Since 
a valid filter Gbt must satisfy G bt Gbt < I, we find C such that this is satisfied while 



C.-H. F. Fung, K. Tamaki, B. Qi, H.-K. Lo, and X. Ma 31 



maximizing the key generation rate in Eq. (|13|) . This problem can be expressed as 

2( 7 |(Ct C ) T ^ /£ | 7 ) 
maxmm t r ■ — — (B.l) 

c | 7 > (j\(F^F +f1f 1 ) t ®I e \ 1 ) te 

s.t. G BT G BT < I. (B.2) 

Note that since we are interested in the worst-case key generation rate, we form a max-min 
problem as opposed to a min-max problem, in light of the max-min inequality: max a mint, 
f(a, b) < mm b max a /(a, b). 

To solve this optimization problem, first note that the condition G bt Gbt < J is the same 
as the condition GbtG bt < I, which can be expanded (by using Eq. Q) as 

\Q,) B (0,| <8> C^Fo)- 1 ^ + \1 Z ) B (l z | ® C(F 1 t F 1 )- 1 C+ < /. (B.3) 

Letting C — CiII^Fq where C\ E <C dxd will be determined next, U E <C dxd is the unitary ma- 
trix of the Hermitian decomposition of Fo(F^Fi)~ 1 Fq = UDU\ and D = diag(Di, . . . , Dd) 
is a diagonal matrix with positive real elements, Eq. (|B.3[) can be expressed as 

%) B (0*1 ® dC? + \W B (U ® G X DC\ < I. (B.4) 

This allows us to redefine the constraints of the problem. 

Next, we consider the objective function in Eq. (|B.1[) . which can be simplified as 



2 ( 7 | (&c) T It) 

( 7 | (F^F + FlF 1 ) T | 7 ) 

2(y|(F t ' 1 ct CF -i )T |Y) 

2( 7 "|(C 1 t C 1 ) r | 7 ") 

(Y'Kj + .d-^tIt") 

2 ( 7 "'| ((/ + D- l )-V*ClCi(! + D _1 ) _1 / 2 )t | 7 " 



Now, the problem can be re-written as 



(y l-y'- 



2( 7 |(C 2 t C 2 ) T ®/ B | 7 ) T£ 



(B.5) 

(B.6) 

(B.7) 
(B.8) 



-Rnoiseicss = max min — — (B.9) 

C'2 | 7 > ( 7 | 7 ) 

si. C 2 (/ + D _1 )C| </ (B.10) 

C 2 (/ + J D)C 2 t < J (B.ll) 
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where C 2 = Ci(J + D r ) x / 2 . We further simply the problem as 

-^noiseless — 



2 max [minimum eigenvalue of C\C-i\ 
C2 



s.t, C 2 



C-2 



1 + 



C 2 f < J 



C 2 T < I. 



The solution is 



C 2 - 



1 -Pi 

l + Di ' 1 + Z5; 



c 



minf -^-,1 



1+D d ' 1+D d 



IPF , 



mini 1 



(B.12) 
(B.13) 

(B.14) 



(B.15) 



(B.16) 



and the final key generation rate can be obtained by substituting Eq. (|B.15P into Eq. (|B.12p : 

1 1 1 



R 



noiseless 



2 min 



l + £>i 1 + 1/Di 1 + D 2 ' 
2 



1 + max 



Appendix C: Simplification of Eqs. (fT9l) - (|22|) 

Here, we show how to simplify e& in Eq. (I19|) . The other quantities in Eqs. ((20 |) -([22 |) can be 
similarly simplified. 

Let's re- write Eq. (|16p by separating the operations for systems B and T by expressing 



E 



BT 



B 



l*^> = E £ B < ' i) (|00) + |H))AB®|7 



(C.l) 



where |<-y('' J >-?)) = E^' |0). Consider Eq. (fT?]) which is expanded as 



^l* 2 



E{Ko iJ) i °)^+4 i,J ' 3 |io)A 



*bl7(M,j)> T + ( C - 2 ) 



C.-H. F. Fung, K. Tamaki, B. Qi, H.-K. Lo, and X. Ma 33 



where 





i) 


Jl,i,3) _ 
"01 ~~ 


4^-4^ 










3) 


(M,j) _ 
"ii — 


a {l,i,3)_ a (l,i,3) 


V2 




V2 



(C.3) 
(C.4) 



and Eve's operation is expressed in terms of the Pauli matrices as E^' — aj I+a^' 1 '^ X- 
4 -iY + afz^Z. Using this notation in Eq. (fT9|) . we have 



Em,,./ a ioWo (r J '\ ipo \r J ) + g{'i< (r J '\ Fp\ \ r J ) 

E/.,,.,- KoVo + a ooWo) (7 J 'I F*F | 7 J ) + rfajk + a^afi) ( 1 j '\f\f 1 \Y) 



(C.5) 



where, for simplicity, J' means (J,i,f) and J means (l,i,j). Focusing on the first term in the 
numerator with fixed I and i, it is equal to 



E a io ta io<7 J 'l^W 

3,3' 

:(( 7 (M,0)| ( 7 (M,1)| ...) 



(C.6) 



/JM,o)t a,i,o) 

' "10 "10 

(M,l)t (l,i,0) 



(l,i,0)i(l,i,l) 

"10 "10 



F^F 



'\j(i,i,o)y 

| 7 a,-«.i)) 



(C.7) 



The second matrix can immediately be recognized as A^ 1 ^ Z\qA^ 1 ^ where Z\q is from 
Eq. (jC.llj) below and 



/ (l,i,o) 



(l,i,0) Al,i,l) 
X X 
(l,i,0) 



(M,0) 



■J 



(C.8) 



By letting 



|0(/,t)) = (A<W®2) 



/| 7 (M,o)}\ 
| 7 (M,l)} 

V : 



(C.9) 



where the identity matrix has dimensions dxd and applying similar arguments to other terms, 
we have 



Em MM) I [gig g F o F Q + got g f i tf i] MM)) 

Em W>(M)I [(^oo + Z w ) ® FjFo + (^n + Z i) <8 F^Fi] |</>(M)) 



(CIO) 



where Z^j are constant matrices shown below in Eq. (jC.lip . Finally, by letting ps = 
EmI^'*)) (<HM)|) E q- (fCTTO)) becomes Eq. (23]). Similarly, Eqs. ([20 j) -(p |) can be simplified 
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where Zij and Xjj are 

Z 00 = 0, 0, l]t)/2 X++ = P([l, 1, 0, 0]t)/2 

Z 10 = P([0, 1, 1, 0]t)/2 1_+ = P([0, 0,-1, l]t)/2 

Z O i=P([0,l,-l,0]t)/2 l + _=P([0,0,l,l]t)/2 (C.ll) 

Z u =P([l,0,0,-l]+)/2 X__=P([l,-l,0,0]t)/2. 

Here, P(|-)) = |-) (-| is the projection operator. 

Appendix D: Solving for the suboptimal bounds 

Here, we prove Eqs. (|27|) and (|28[), First, we consider solving 

Psucc.noisy > mm ^- ; -= ^— t — — (D.l) 

10) (0| [{Zoo + Z w ) ® P f P + (Zn + Z 01 ) ® P/Pi] |0) 

where the right hand side comes from Eq. (|26| and Zoo + ^io + + Z)i = I- Here, we only 
need to focus on rank-one pe — \4>) (01 because of the following claim. 

Claim 1 Given two ratios, ^- and where m, o 2 , 6i, 6 2 G K+, if ^ > I 1 , then ^ > 2i±|l. 
Similarly, if ^ < ^ then ^ < «i±£l. 

J ' 02 — 02 5 02 — O2+02 

This claim basically means that we only need to focus on the smallest or the largest ratio 
when there are more than one ratio to optimize over. By substituting \<f>') = [(Z o + Z 10 ) <8> 
Fo + (Zn + Zoi) ® Pi] |0) into the right hand side of Eq. (|D.lj) . we get 



. . (4>'\ [{Zqq + Z 10 ) g F-tCtCPp- 1 + (Z n + goi) g fftgtgf^] |o. ... 

Psuccnoisy > mm . ^U.Zj 



By noting that Zoo + -^10 and Zn + Zoi are orthogonal, the minimum eigenvalue of Eq. (|D.2|) 
is the minimum of the eigenvalues of F^'C^CFf 1 where i = 0, 1. By using Eq. (|B.16[) , one 
can immediately see that the eigenvalues of F ~^ CF^ 1 are 

minQ^l) i = l,...,d (D.3) 

and that of F^C^CF^ 1 arc 

min(A,l) i = l,...,d. (D.4) 

Taking the minimum of these two sets of eigenvalues gives Eq. (|27p . 

Next, we consider the maximization of e p /e' p in Eq. (f2"5| . Using Eqs. and ([23]) (and 
Claim [1]), we have 

e„ (0|X_ + ®CtC|0) + (01 ® CtC 10) 



X_+ ® PjPo |0) + (0| l+_ <g> P^Pi 



+ X-+) g PptPp |0) + (0| (X— + g F\F l |0) 

>|(X ++ +l_+)®CtC|0) + (0|(X__+X + _)®CtC|0) ' 
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According to Claim [TJ the first ratio in Eq. (|D.5j) is upper bounded by the maximum of the 
eigenvalues of Ff^C^CFf 1 where i = 0, 1; while the second ratio is upper bounded by inverse 
of the minimum of the same set of eigenvalues. Therefore, using Eqs. JE^-Jd!}, 



e P min [D 1: -^,...,D d , -L, lj 

where the numerator (= 1) corresponds to the upper bound on the first ratio. This proves 
Eq. (USD. 



